Privacy policy

In short

We think it matters that you know what happens to your data when you visit our website or get in touch with us. That is why we keep this policy as short and as readable as we can. The heart of it is this: we measure how our website is used, but only if you allow it, and we sell your data to no one. Say no and nothing is measured, and the site keeps working just the same.

Who is responsible for your data?

Goldlab Agency is responsible for processing the data that comes in through this website. We are based in Drunen in the Netherlands, registered with the Dutch Chamber of Commerce under number 90089545, and our VAT number is NL004786378B80. Our full registered address is available on request.

We are not required to appoint a data protection officer and we have not done so. You can reach us with any privacy question at projects@goldlab-agency.com.

What data do we collect through this website?

Only the data you enter into the contact form yourself. That means your name, your email address, the name of your company or brand, the type of project you have in mind and the message you write. Your name, your email address and your message are required, and you may leave the other two fields empty.

We add nothing to that ourselves. We store no IP address, no time of sending and no information about your device or your browser.

There is also no database behind this website. Your message is turned into an ordinary email and arrives in our mailbox, and from then on it exists only as an email.

When you open the site for the first time, the website reads the language preference your browser sends along automatically, so that you immediately get the Dutch or the English version. We use that preference at that moment and record it nowhere else.

Why do we need that data, and are we allowed to?

We use what you enter for one purpose, namely to reply to your message and, where that is relevant, to talk further about working together. We do not use your email address for newsletters or other advertising, unless you explicitly ask us to.

The legal basis for this is the performance of a contract or the steps leading up to one, because you approach us with a concrete question. Where that does not apply, we rely on our legitimate interest in being able to reply to someone who contacts us of their own accord.

For measuring visits and advertising the basis is your consent, and nothing else. That consent is freely given, you can withdraw it as easily as you gave it, and refusing has no effect whatsoever on what you can do on the site.

How long do we keep your data?

Messages that do not lead to a collaboration are kept for a maximum of twelve months, so that we can still find an earlier conversation if you get in touch again later. After that we delete them.

If you become a client, we keep the correspondence for as long as the collaboration runs. Invoices and the related administration are kept for a further seven years after that, because Dutch tax law requires it.

What Google Analytics records about your visit is deleted after fourteen months. What Meta records falls under their own retention periods, over which we have no influence. Your consent choice itself is kept for six months, after which we ask again so that a choice does not quietly run on for years.

Do you use cookies?

Yes, and you choose which ones. A few cookies are always needed to make the site work, for instance to remember your language and your cookie choice. The cookies for measuring visits and advertising are only set once you have said yes to them.

Our cookie statement lists every cookie, what it is for and how long it lasts.

The website also stores one value in your browser's temporary storage, under the name goldlab-intro. It lets us remember that you have already seen the opening animation, so that you are not shown it again on every page. That value disappears the moment you close the tab and contains nothing that can be traced back to you.

Am I tracked on this website?

Only if you say yes to it. On your first visit we ask in a panel at the bottom of the page whether we may measure, and until you make that choice nothing happens. If you refuse, not a single request goes to Google or Meta and the whole site keeps working normally.

If you do give permission, we use Google Analytics to see how many people visit our site and which pages they look at, and the Meta pixel to measure whether our ads on Instagram and Facebook achieve anything. You can change your choice at any time through the Cookie preferences link at the bottom of every page.

We never see who you are in the process. What we get are numbers and sources, for instance that thirty people came in through Instagram today. Only when you fill in the contact form yourself do we know who we are dealing with.

We load our typefaces from our own server, so your browser makes no connection to Google for those. There are no embedded YouTube or Vimeo videos on the site and no images fetched from third parties.

What exactly do you measure?

If you have given permission, Google and Meta record which pages you view, how long you stay, which link brought you in, which country you are in and what device and browser you use. That comes with a random number they use to recognise your browser when you return, so a second visit is not counted as a new visitor.

If you fill in the contact form and send it successfully, we record that as an enquiry, together with the type of project you selected. That lets us see which channel actually brings us clients. Your name, your email address and the content of your message do not travel to Google or Meta. Those stay between the form and our mailbox.

Who else sees your data?

To keep the website running and to get your message to us, we work with a number of service providers. They may use your data only for the purpose we engage them for.

• Netlify hosts this website and processes technical connection data such as your IP address in doing so, which is what makes showing a website possible at all.
• Resend delivers the contact form to our mailbox.
• Microsoft provides our mailbox through Outlook and our file storage through OneDrive, which is where your message ends up once it has been sent.
• Google provides Google Analytics, which we use to measure visits to our website. This only happens after you allow it.
• Meta provides the pixel we use to measure our advertising on Instagram and Facebook. This too only happens after you allow it.

Is my data processed outside Europe?

Netlify, Resend, Google and Meta are American companies, which means your data is processed in part in the United States. For that transfer we rely on the EU-US Data Privacy Framework and, where that does not apply, on the standard contractual clauses drawn up by the European Commission.

What data do we process for clients?

If we work together, we also process the data that comes with that collaboration, such as contact details, invoicing details and the footage we shoot for you or receive from you. For that we use Notion for planning and project administration, WhatsApp for day to day contact, OneDrive for exchanging files, ManyChat and Metricool for managing and publishing content, CapCut for editing, PandaDoc for quotes and contracts, Claude as a writing assistant and Obsidian for our internal knowledge base.

Where recognisable people appear in the footage we make, we make sure there is prior consent and we record where that material may be used. When clients engage us they agree that we may show the work we made for them, along with their company name, in our own portfolio, on our website and on our social channels. Material a client gives us in confidence, or has not yet published themselves, is excluded from this.

How do we keep your data safe?

The website is fully secured with an encrypted connection, which you can recognise by the padlock in your browser. The contact form has a hidden field that stops automated spam without you noticing anything. Our mailbox and our working environment are protected with two-factor authentication, and only Rick and Joan have access to the data that comes in through the website.

What rights do you have?

You have the right to know what data we hold about you and to request a copy of it. If that data is wrong, you can ask us to correct it. You can also ask us to delete your data, to restrict how we process it, or to hand your data over to you in a readable file. On top of that, you can object to the processing where we rely on our legitimate interest.

Send your request to projects@goldlab-agency.com. We reply within one month. To prevent us handing data to the wrong person, we may ask you to send your request from the email address you used to contact us earlier.

If you have allowed measurement, you can withdraw that at any time through the Cookie preferences link at the bottom of every page. That is as simple as giving it. What was measured before you withdrew remains, but from that moment on it stops.

Where can you file a complaint?

If you disagree with how we handle your data, we would rather hear it from you first, so that we can put it right. If we cannot resolve it together, you have the right to file a complaint with the Dutch Data Protection Authority through autoriteitpersoonsgegevens.nl.

Can this policy change?

This policy may change when our website or the way we work changes, for instance when we start using a new service. The date at the top of this page shows when we last updated it.